fix: make LoadConfig read-only to prevent panic on read-only filesystems

LoadConfig() tried to create directories and write opal.yml as a side
effect of loading config. On the server (where /etc/opal is in systemd
ReadOnlyPaths), this failed, returning nil. All internal GetConfig()
callers discarded the error, passing nil to BuildUrgencyCoefficients()
which panicked on nil dereference.

Redesign the config system with layered, read-only loading:
- Defaults (always present) → YAML file (if exists) → OPAL_ env vars
- LoadConfig never writes to the filesystem or returns nil
- File creation moved to explicit InitConfig() for CLI first-run/setup
- SaveConfig uses yaml.Marshal instead of manual field-by-field Viper
  calls, eliminating the three-place maintenance burden

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

opal-task/cmd/root.go

@@ -244,16 +244,20 @@ func initializeApp() {
 		os.Exit(1)
 	}
 
-	// Load config
+	// On first run, create the config file with defaults
+	if isFirstRun {
+		if err := engine.InitConfig(); err != nil {
+			fmt.Fprintf(os.Stderr, "Error creating config: %v\n", err)
+			os.Exit(1)
+		}
+		showFirstRunMessage()
+	}
+
+	// Load config (reads file if present, otherwise uses defaults)
 	if _, err := engine.LoadConfig(); err != nil {
 		fmt.Fprintf(os.Stderr, "Error loading config: %v\n", err)
 		os.Exit(1)
 	}
-
-	// Show first-run message after config is created
-	if isFirstRun {
-		showFirstRunMessage()
-	}
 }
 
 func showFirstRunMessage() {